Skillv1.0.0

ClawScan security

SAAS Revenue Tracker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 16, 2026, 1:38 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only SAAS metrics/advice skill with placeholder files and no credentials, installs, or external endpoints requested — its requirements and behavior are consistent with its description.
Guidance: This skill is instruction-only and appears coherent with its stated purpose. Before installing or enabling it broadly: (1) confirm you trust the skill source (source/homepage unknown); (2) review any future code files added to ensure they don't introduce network calls, credential usage, or file-system access; and (3) remember the platform allows autonomous invocation by default — while this skill currently has no dangerous capabilities, always review changes before granting broader privileges.

Purpose & Capability: okThe name and description match the SKILL.md content: guidance on MRR, churn, CAC, forecasting, and actions. There are no unrelated credentials, binaries, or config paths requested that would be unexpected for a revenue-tracking/advisory skill.
Instruction Scope: okSKILL.md contains only business guidance, metrics, and review processes. It does not instruct the agent to read arbitrary system files, access environment variables, call external endpoints, or exfiltrate data.
Install Mechanism: okNo install spec is present (instruction-only). The included files are placeholders/example assets and a trivial example script that only prints text; nothing downloads or extracts code from external URLs.
Credentials: okRequires no environment variables, credentials, or config paths. The skill does not request or imply access to unrelated services or secrets.
Persistence & Privilege: okFlags show default behavior (not always: true). The skill does not request permanent inclusion, nor does it attempt to modify other skills or system-wide agent settings.